Wow I sent that message yesterday. There must be a delay for first time posters....

We need a way to specify the default behavior for a document (eg "origin"), then for certain links we need a way to specify a more relaxed policy (eg "unsafe-url"). We have cases where we want to share referer query parameters between domains (https://search.yahoo.com to https://www.flickr.com for example) but generally we want everyone else to get the origin (even when downgrading to http). The logic defining when to do this is complex and shouldn't be added into the spec (please no "use-yahoo-logic" policy directive). If we have a way to loosen the per document policy for individual "a" elements (and form submits now that I think about it) we should be good. For single page apps we need to be able to insert "a" elements client-side so it might be worthwhile to add something explicit into the spec which allows that.